Skip to content

Instantly share code, notes, and snippets.

@nathabonfim59
Created July 23, 2022 07:35
Show Gist options
  • Save nathabonfim59/b088db8752673e1e7acace8806390242 to your computer and use it in GitHub Desktop.
Save nathabonfim59/b088db8752673e1e7acace8806390242 to your computer and use it in GitHub Desktop.

How to fix the "Failed to close file descriptor for child process (Operation not permitted)" in your docker ci build

Disclaimer

First off, I'm not a docker expert by any means. I just wanted my CI pipeline to work and went down the habbit hole. The solution I present can cause some security implications, be aware.

Cause

The problem is caused by a seccomp policy and a glibc >= 2.34 update that returns an EPERM (operation not permitted) insted of ENOSYS (function not implemented).

Solution/Workaround

Run your container with --security-opt seccomp=unconfined.

Example from Docker:

docker run --rm -it --security-opt seccomp=unconfined debian:jessie

Further reading

@Tiryoh
Copy link

Tiryoh commented Jul 24, 2022

Great! Thanks a lot!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment